Merge pull request Invoke-IR#5 from jaredcatkinson/master

Directory reorg and Added $UsnJrnl:$Max
infosecCLI · Aug 25, 2015 · c3faaf7 · c3faaf7
2 parents a1d3e5c + 0fc4f64
commit c3faaf7
Show file tree

Hide file tree

Showing 33 changed files with 969 additions and 0 deletions.
diff --git a/...DARD_INFORMATION/$STANDARDINFORMATION.svg → ...DARD_INFORMATION/$STANDARDINFORMATION.svg b/...DARD_INFORMATION/$STANDARDINFORMATION.svg → ...DARD_INFORMATION/$STANDARDINFORMATION.svg
diff --git a/...ARD_INFORMATION/$STANDARD_INFORMATION.png → ...ARD_INFORMATION/$STANDARD_INFORMATION.png b/...ARD_INFORMATION/$STANDARD_INFORMATION.png → ...ARD_INFORMATION/$STANDARD_INFORMATION.png
diff --git a/... Attributes/0x30_$FILE_NAME/$FILENAME.svg → ... Attributes/0x30_$FILE_NAME/$FILENAME.svg b/... Attributes/0x30_$FILE_NAME/$FILENAME.svg → ... Attributes/0x30_$FILE_NAME/$FILENAME.svg
diff --git a/...Attributes/0x30_$FILE_NAME/$FILE_NAME.png → ...Attributes/0x30_$FILE_NAME/$FILE_NAME.png b/...Attributes/0x30_$FILE_NAME/$FILE_NAME.png → ...Attributes/0x30_$FILE_NAME/$FILE_NAME.png
diff --git a/...ibutes/0x60_$VOLUME_NAME/$VOLUME_NAME.png → ...ibutes/0x60_$VOLUME_NAME/$VOLUME_NAME.png b/...ibutes/0x60_$VOLUME_NAME/$VOLUME_NAME.png → ...ibutes/0x60_$VOLUME_NAME/$VOLUME_NAME.png
diff --git a/...ibutes/0x60_$VOLUME_NAME/$VOLUME_NAME.svg → ...ibutes/0x60_$VOLUME_NAME/$VOLUME_NAME.svg b/...ibutes/0x60_$VOLUME_NAME/$VOLUME_NAME.svg → ...ibutes/0x60_$VOLUME_NAME/$VOLUME_NAME.svg
diff --git a/...OLUME_INFORMATION/$VOLUME_INFORMATION.png → ...OLUME_INFORMATION/$VOLUME_INFORMATION.png b/...OLUME_INFORMATION/$VOLUME_INFORMATION.png → ...OLUME_INFORMATION/$VOLUME_INFORMATION.png
diff --git a/...OLUME_INFORMATION/$VOLUME_INFORMATION.svg → ...OLUME_INFORMATION/$VOLUME_INFORMATION.svg b/...OLUME_INFORMATION/$VOLUME_INFORMATION.svg → ...OLUME_INFORMATION/$VOLUME_INFORMATION.svg
diff --git a/4_MFT Attributes/0x80_$DATA/$DATA.png → ...ecord/MFT Attributes/0x80_$DATA/$DATA.png b/4_MFT Attributes/0x80_$DATA/$DATA.png → ...ecord/MFT Attributes/0x80_$DATA/$DATA.png
diff --git a/4_MFT Attributes/0x80_$DATA/$DATA.svg → ...ecord/MFT Attributes/0x80_$DATA/$DATA.svg b/4_MFT Attributes/0x80_$DATA/$DATA.svg → ...ecord/MFT Attributes/0x80_$DATA/$DATA.svg
diff --git a/0_Master File Table Record/MFT Attributes/0x90_$INDEX_ROOT/$INDEX_ROOT.svg b/0_Master File Table Record/MFT Attributes/0x90_$INDEX_ROOT/$INDEX_ROOT.svg
diff --git a/3_Master File Table Record/MFT.png → 0_Master File Table Record/MFT.png b/3_Master File Table Record/MFT.png → 0_Master File Table Record/MFT.png
diff --git a/...ter File Table Record/MasterFileTable.svg → ...ter File Table Record/MasterFileTable.svg b/...ter File Table Record/MasterFileTable.svg → ...ter File Table Record/MasterFileTable.svg
diff --git a/Artifacts/UsnJrnl/$UsnJrnl_$J.png → 11_$Extend/$UsnJrnl/$UsnJrnl_$J.png b/Artifacts/UsnJrnl/$UsnJrnl_$J.png → 11_$Extend/$UsnJrnl/$UsnJrnl_$J.png
diff --git a/Artifacts/UsnJrnl/$UsnJrnl_$J.svg → 11_$Extend/$UsnJrnl/$UsnJrnl_$J.svg b/Artifacts/UsnJrnl/$UsnJrnl_$J.svg → 11_$Extend/$UsnJrnl/$UsnJrnl_$J.svg
diff --git a/11_$Extend/$UsnJrnl/$UsnJrnl_$Max.png b/11_$Extend/$UsnJrnl/$UsnJrnl_$Max.png
diff --git a/11_$Extend/$UsnJrnl/$UsnJrnl_$Max.svg b/11_$Extend/$UsnJrnl/$UsnJrnl_$Max.svg
diff --git a/2_Volume Boot Record ($Boot)/VBR.png → 7_$Boot (Volume Boot Record)/VBR.png b/2_Volume Boot Record ($Boot)/VBR.png → 7_$Boot (Volume Boot Record)/VBR.png
diff --git a/...ot Record ($Boot)/VolumeBootRecord101.svg → ...lume Boot Record)/VolumeBootRecord101.svg b/...ot Record ($Boot)/VolumeBootRecord101.svg → ...lume Boot Record)/VolumeBootRecord101.svg
diff --git a/... Sector/1A_Master Boot Record/HexDump.txt → ... Sector/1A_Master Boot Record/HexDump.txt b/... Sector/1A_Master Boot Record/HexDump.txt → ... Sector/1A_Master Boot Record/HexDump.txt
diff --git a/1_Boot Sector/1A_Master Boot Record/MBR.png → _Boot Sector/1A_Master Boot Record/MBR.png b/1_Boot Sector/1A_Master Boot Record/MBR.png → _Boot Sector/1A_Master Boot Record/MBR.png
diff --git a/...aster Boot Record/MasterBootRecord101.svg → ...aster Boot Record/MasterBootRecord101.svg b/...aster Boot Record/MasterBootRecord101.svg → ...aster Boot Record/MasterBootRecord101.svg
diff --git a/...ector/1A_Master Boot Record/harddrive.png → ...ector/1A_Master Boot Record/harddrive.png b/...ector/1A_Master Boot Record/harddrive.png → ...ector/1A_Master Boot Record/harddrive.png
diff --git a/...ot Sector/1B_Guid Partition Table/GPT.png → _Boot Sector/1B_Guid Partition Table/GPT.png b/...ot Sector/1B_Guid Partition Table/GPT.png → _Boot Sector/1B_Guid Partition Table/GPT.png
diff --git a/...id Partition Table/GuidPartitionTable.svg → ...id Partition Table/GuidPartitionTable.svg b/...id Partition Table/GuidPartitionTable.svg → ...id Partition Table/GuidPartitionTable.svg
diff --git a/_Posters/1A_MBR.png → __Posters/1A_MBR.png b/_Posters/1A_MBR.png → __Posters/1A_MBR.png
diff --git a/_Posters/1B_GPT.png → __Posters/1B_GPT.png b/_Posters/1B_GPT.png → __Posters/1B_GPT.png
diff --git a/_Posters/2_VBR.png → __Posters/2_VBR.png b/_Posters/2_VBR.png → __Posters/2_VBR.png
diff --git a/_Posters/3_MFT.png → __Posters/3_MFT.png b/_Posters/3_MFT.png → __Posters/3_MFT.png
diff --git a/_Posters/4_0x10_$STANDARD_INFORMATION.png → __Posters/4_0x10_$STANDARD_INFORMATION.png b/_Posters/4_0x10_$STANDARD_INFORMATION.png → __Posters/4_0x10_$STANDARD_INFORMATION.png
diff --git a/_Posters/4_0x30_$FILE_NAME.png → __Posters/4_0x30_$FILE_NAME.png b/_Posters/4_0x30_$FILE_NAME.png → __Posters/4_0x30_$FILE_NAME.png
diff --git a/_Posters/Prefetch101.png → __Posters/Prefetch101.png b/_Posters/Prefetch101.png → __Posters/Prefetch101.png
diff --git a/_Posters/UsnJrnl_$J.png → __Posters/UsnJrnl_$J.png b/_Posters/UsnJrnl_$J.png → __Posters/UsnJrnl_$J.png